Sniffair - A Framework For Wireless Pentesting - Hi friends mederc, In the article that you read this time with the title Sniffair - A Framework For Wireless Pentesting, We have prepared this article well for you to read and retrieve information from it. hopefully fill the posts Article Brute-force, Article Captive Portal, Article Evil Twin, Article Framework, Article Handshake, Article HoneyPot, Article Kali, Article Mac, Article Mac Changer, Article Packet, Article Packets, Article Pcap, Article Penetration Test, Article Python, Article SniffAir, Article TP-LINK, Article Wireless, Article WPA2, we write this you can understand. Alright, happy reading.

Title : Sniffair - A Framework For Wireless Pentesting
link : Sniffair - A Framework For Wireless Pentesting

Sniffair - A Framework For Wireless Pentesting

SniffAir is an open-source wireless safety framework which provides the mightiness to easily parse passively collected wireless information every bit good every bit launch sophisticated wireless attacks. SniffAir takes aid of the hassle associated alongside managing large or multiple pcap files land thoroughly cross-examining as well as analyzing the traffic, looking for potential safety flaws. Along alongside the prebuilt queries, SniffAir allows users to exercise custom queries for analyzing the wireless information stored inward the backend SQL database. SniffAir is built on the concept of using these queries to extract information for wireless penetration test reports. The information tin every bit good survive leveraged inward setting upwards sophisticated wireless attacks included inward SniffAir every bit modules.

SniffAir is developed past times @Tyl0us as well as @theDarracott

Install
SniffAir was developed alongside Python version 2.7
Tested as well as supported on Kali Linux, Debian as well as Ubuntu.
To install run the setup.sh script

$./setup.sh

Usage

                                                                     % *        ., %                                                                                              % ( ,#     (..# %                             /@@@@@&,    *@@%        &@,    @@#    /@@@@@@@@@   .@@@@@@@@@. ,/ # # (%%%* % (.(.  .@@     &@@@@@@%.       .@@&   *&@    %@@@@.      &@,    @@%    %@@,,,,,,,   ,@@,,,,,,,  .( % %  %%#  # % #   ,@@     @@(,,,#@@@.     %@%           %@@(@@.     &@,    @@%    %@@          ,@@          /* #   /*,   %.,,   ,@@     @@*     #@@     ,@@&          %@@ ,@@*    &@,    @@%    %@@          ,@@           .#   //#(,   (,    ,@@     @@*     &@%      .@@@@@.      %@@  .@@(   &@,    @@%    %@@%%%%%%*   ,@@%%%%%%#         (# ##.        ,@@     @@&%%%@@@%           *@@@@    %@@   .@@/  &@,    @@%    %@@,,,,,,    ,@@,,,,,,.        %#####%        ,@@     @@(,,%@@%               @@%   %@@     @@( &@,    @@%    %@@          ,@@              %  (*/  #       ,@@     @@*    @@@              %@%   %@@      @@&&@,    @@%    %@@          ,@@             %  #  .# .#      ,@@     @@*     @@%    .@@&/,,#@@@    %@@       &@@@,    @@%    %@@          ,@@            /(*       /(#     ,@@     @@*      @@#     *%@@@&*      *%#        ,%#     #%/    *%#           %%            #############.    .%#     #%.      .%%                                                                    (@Tyl0us & @theDarracott)   >>  [default]# aid Commands ======== workspace                Manages workspaces (create, list, load, delete) live_capture             Initiates a valid wireless interface to collect wireless pakcets to survive parsed (requires the interface name) offline_capture          Begins parsing wireless packets using a pcap file-kismet .pcapdump piece of occupation best (requires the total path) offline_capture_list     Begins parsing wireless packets using a listing of pcap file-kismet .pcapdump piece of occupation best (requires the total path) interrogation                    Executes a interrogation on the contents of the acitve workspace aid                     Displays this aid carte du jour clear                    Clears the enshroud exhibit                     Shows the contents of a table, specific information across all tables or the available modules inscope                  Add ESSID to scope. inscope [ESSID] SSID_Info                Displays all information (i.e all BSSID, Channels as well as Encrpytion) related to the inscope SSIDS move                      Use a SniffAir module information                     Displays all variable information regarding the selected module fix                      Sets a variable inward module exploit                  Runs the loaded module run                      Runs the loaded module perish                     Exit SniffAir  >>  [default]# 

Begin
First exercise or charge a novel or existing workspace using the ascendence workspace exercise <workspace> or workspace charge <workspace> command. To sentiment all existing workspaces move the workspace list ascendence as well as workspace delete <workspace> ascendence to delete the desired workspace:

 >>  [default]# workspace      Manages workspaces  Command Option: workspaces [create|list|load|delete] >>  [default]# workspace exercise demo [+]  Workspace demo created

Load information into a desired workplace from a pcap file using the ascendence offline_capture <the total path to the pcap file>. To charge a serial of pcap files move the ascendence offline_capture_list <the total path to the file containing the listing of pcap name> (this file should comprise the total patches to each pcap file). Use the live_capture <interface name> ascendence to capture alive wireless traffic using a wireless interface.

>>  [demo]# offline_capture /root/sniffair/demo.pcapdump [+] Importing /root/sniffair/demo.pcapdump \ [+] Completed [+] Cleaning Up Duplicates [+] ESSIDs Observed

Show Command
The show ascendence displays the contents of a table, specific information across all tables or the available modules, using the next syntax:

 >>  [demo]# exhibit tabular array AP +------+-----------+-------------------+-------------------------------+--------+-------+-------+----------+--------+ |   ID | ESSID     | BSSID             | VENDOR                        |   CHAN |   PWR | ENC   | CIPHER   | AUTH   | |------+-----------+-------------------+-------------------------------+--------+-------+-------+----------+--------| |    1 | HoneyPot  | c4:6e:1f:##:##:## | TP-LINK TECHNOLOGIES CO. LTD. |      iv |   -17 | WPA2  | TKIP     | MGT    | |    2 | Demo      | 80:2a:a8:##:##:## | Ubiquiti Networks Inc.        |     eleven |   -19 | WPA2  | CCMP     | PSK    | |    three | Demo5ghz  | 82:2a:a8:##:##:## | Unknown                       |     36 |   -27 | WPA2  | CCMP     | PSK    | |    iv | HoneyPot1 | c4:6e:1f:##:##:## | TP-LINK TECHNOLOGIES CO. LTD. |     36 |   -29 | WPA2  | TKIP     | PSK    | |    five | BELL456   | 44:e9:dd:##:##:## | Sagemcom Broadband SAS        |      six |   -73 | WPA2  | CCMP     | PSK    | +------+-----------+-------------------+-------------------------------+--------+-------+-------+----------+--------+  >>  [demo]# exhibit SSIDS --------- HoneyPot Demo HoneyPot1 BELL456 Hidden Demo5ghz --------- 

The query ascendence tin survive used to display a unique fix of information based on the parememters specificed. The query ascendence uses sql syntax.

Inscope
the inscope <SSID> ascendence tin survive used to add together a SSID to the inscope tables, loading all related information to the inscope_AP, inscope_proberequests as well as inscope_proberesponses tables. To sentiment a summary of all inscope SSIDS run the SSID_Info command.

Modules
Modules tin survive used to analyze the information contained inward the workspaces or perform offensive wireless attacks using the use <module name> command. For roughly modules additional variables may involve to survive set. They tin survive fix using the fix ascendence set <variable name> <variable value>:

 >>  [demo]# exhibit modules Available Modules ================= [+] Auto EAP - Automated Brute-Force Login Attack Against EAP Networks [+] Auto PSK - Automated Brute-Force Passphrase Attack Against PSK Networks [+] AP Hunter - Discover Access Point Within  a Certain Range Using a Specific Type of Encrpytion [+] Captive Portal - Web Based Login Portal to Capture User Entered Credentials (Runs every bit an OPEN Network) [+] Certificate Generator - Generates a Certificate Used past times Evil Twin Attacks [+] Exporter - Exports Data Stored inward a Workspace to a CSV File [+] Evil Twin - Creates a Fake Access Point, Clients Connect to Divulging MSCHAP Hashes or Cleartext Passwords [+] Handshaker - Parses Database or .pcapdump Files Extracting the Pre-Shared Handshake for Password Guessing (Hashcat or JTR Format) [+] Mac Changer - Changes The Mac Address of an Interface [+] Probe Packet - Sends Out Deauth Packets Targeting SSID(s) [+] Proof Packet - Parses Database or .pcapdump Files Extracting all Packets Related to the Inscope SSDIS [+] Hidden SSID - Discovers the Names of HIDDEN SSIDS [+] Suspicious AP - Looks for Access Points that: Is On Different Channel, move a Different Vendor or Encrpytion Type Then the Rest of The Network [+] Wigle Search SSID - Queries wigle for SSID (i.e. Bob's wifi) [+] Wigle Search MAC - Queries wigle for all observations of a unmarried mac address  >>  [demo]#   >>  [demo]# move Captive Portal  >>  [demo][Captive Portal]# information Globally Set Varibles =====================  Module: Captive Portal  Interface:   SSID:   Channel:   Template: Cisco (More to survive added soon)  >>  [demo][Captive Portal]# fix Interface wlan0  >>  [demo][Captive Portal]# fix SSID demo  >>  [demo][Captive Portal]# fix Channel 1  >>  [demo][Captive Portal]# information Globally Set Varibles =====================  Module: Captive Portal  Interface: wlan0  SSID: demo  Channel: 1  Template: Cisco (More to survive added soon)  >>  [demo][Captive Portal]# 

Once all varibles are set, hence execute the exploit or run ascendence to run the desired attack.

Export
To export all information stored inward a workspace’s tables using the Exporter module as well as setting the desired path.

Acknowledgments
Sniffiar contains piece of occupation from the next repoisoties:

• hostapd-wpe
• jmalinen/hostap
• lootbooty

Download SniffAir

Thus the article Sniffair - A Framework For Wireless Pentesting

That's all the article Sniffair - A Framework For Wireless Pentesting this time, hopefully can benefit you all. okay, see you in another article posting.

You are now reading the article Sniffair - A Framework For Wireless Pentesting with the link address https://mederc.blogspot.com/2019/09/sniffair-framework-for-wireless.html

Share this post